task manager registry key

hi all

I can't use alt crtl delete and I found out it was disabled in gpedit and i set it to unconfigured but didnt work.

I also used spyware dr and it gave me a tojan generic (meduim) , and the registry line was pointing to :

HKEY_USERS\S-1-5-21-3433162778-2826650621-2974146706-500\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr


I opened regedit and only found :

HKEY_USERS\S-1-5-21-3433162778-2826650621-2974146706-1004\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ >>> NoDriveTypeAutoRun

I couldnt find Policies\"system" , and also searching current user & local mashine I didnt find that key.

So:
Where did spyware Doctor find it ?

Why is ctrl manager hidden ? ( I used norton online scan and the computer is clean) , how to fix it ?

PS. Spyware doctor found one file item called XPbutton.ocx which he thinks its related to spy anytime keylogger, but its trial and can't use clean .

thanks

 

try downloading superantispyware link in my sig. free version
install,update,scan and remore what it finds.
then go to settings,repair tab and find the restore task manager.
there are other repairs as well if you need them.
you can then also run scans with drweb cure it and f-secure easy clean.

 

Perhaps one of Spyware Doctor's "Legendary" false positives?
PS:Follow Lodore's advice

 

A .ocx is an IE addon much like flash player. You can delete it in IE from the internet options.

As Emperor Darius said it could be a false positive, but its unlikely. SD isnt know for false positives. Its the best anti-spyware app on the market at this point. I highly doubt it got to that position by giving false positives.

 

have you ever tryed the free version of spyware doctor?
its full of fp's to trick users in to buying it.
search the net and you will find alot about it..
i wouldnt touch it with a barge poll
definatly not the best on the market.

 

Then tell that to the people who have reviewed it at the numerous sites its been rated as the top Anti-Spyware app. Clearly they have missed something you caught on to.

They arent false positives. They are legit. The program just has a unique marketing scheme in the sense that the trial doesnt do anything other than let you know what it detects. You can manually remove what it detects, but to have SD do it you need to pay.

 

there have been enough people who have had stuff detected by the free version and then paid and nothing was detected..
you should be able to remove malware in the free trial just like counterspy does..

 

Who said you should? Nobody governs how trials work or how they should besides the individual company that made it. If you dont like it and think its bad then dont use it, but beware that its the best out there and there is a possibility that what you are using doesnt pick up what you have. Dont believe, me check out these ratings.

http://www.pcmag.com/article2/0,2817,2326198,00.asp

http://www.antispyware-softwarereviews.com/

 

I don't think it's "the best". It may be good, but that doesn't change the fact that it makes a lot of false positives. Thing that other Antispywares, which include some free ones, don't do and detect pretty much the same amount of spyware.
BTW: the second like is a joke and shouldn't even be considered.

 

Like I said. Any malware type of program doesnt make the best of its class by giving false positives. False positives lower the rating. Either way SAS is a good one, Spybot is good only for its Immunize feature and the ability to edit Host files, and AdAware is also good.

 

How to open Task Manager
Ctrl/Alt/Del
Ctrl/Shift/Esc
or right click on the notification area and select TM.

No point installing another app for this, try this site first...

kellys-korner click on T, about 1/4 way down that page.

 

That site only explained what the bytes in TM mean. The computer is infected.

 

Edited my post

 

Regardless of if it works or not. The most likely reason it was disabled is due to spyware in which case the computer will need to be scanned and cleaned before he does it. If the removal works there is no need for that website. If he doesnt scan it first it will happen on the next reboot because he didnt clean it in the first place.

 

Personally I would kinda like a task manager working to aid in any removal of infection, although I do use process explorer.

 

TM plays no role in deleting spyware or registry keys put in place by spyware so it doesnt matter if it works or not.

 

Using tm or process explorer will aid you in reviewing suspicious processes, that's unless malware hooks the call to ntdll.dll and prevents malware processes being returned to tm or modifying the list with system call hooking.

 

There is no suspicious process that makes TM unusable. Its a registry edit.

 

Didn't say there was, I don't think you understood my post, I was saying why I would like to have a process explorer if infected as you seemed to dismiss it out of hand.

exactly, as it seems here, but there are other ways.

 

You forgot MBAM

 

Sorry all for taking time to answer I was still testing things
thanks all for helping

despite that many companies like counterspy claim that their software use port 80 , most tools can't update using my limited connection !

counterspy: update error
superantispyware: update error (no proxy settings)
spysweeper: update error
spyware doctor : updated successfully

but it doesn't fix in trial mode but that's the start only !
It never gave me the same result again The second and third full scan never gave the same number of results , it came down to 4 results , there were 6 at least, if spyware doctor doesn't fix in trial mode, why I am not seeing them again then

Searching my PC using Symantec online scan doesn't find keyloggers spyware like XPbutton.OCX or anything

strange results !
using keyborad test I found many keys don't work including delete
but again I can still use shift & delete sometimes

I want to move to Vista and still don't know how to get the taskmanager
I will test the other methods and see if it comes out or not ?

Guys, can I bother you with another issue with Task Manager in different computer ??

another computer with admin rights is getting errors like snap in for this task has been used to disable this task ,,, or something like that

I went through all the system32 tools like computer management and computer policy security policy and none were used, the account is an admin, but for example system restore is still hidden ?

is isasser.exe involved

How to clean computer if I can't access system restore even in Administrator account kaspersky scan tool only found isasser.exe in each drive and deleted them but nothing more ?